53c74a3d0b08189d69212ec37c978d9d2551900d505a6603d1b425d40ef1791e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
Size 11.7MB
Sample260814-js35rayamh
SHA256 53c74a3d0b08189d69212ec37c978d9d2551900d505a6603d1b425d40ef1791e
MD5 5793ff293df700b4db4de05dfbf9530c
SHA1 434ff0a9b120909b3fb7ec059e1864a8c8cb160e
SHA512 a788d3f9ad5094eedcea72831b2ce4e4fd708573f7526562848b5109cc17881b599be1a45fb6a188b907636e96b10566d8440780f55e98465e1260f897632d36
SSDEEP 196608:5WcjhQUF+nFQ+7mM7N/e/ymdAPJ1KpvGkKQMfKIfBAN/CIQm3A9kB+k:5WcGUF+nFQqmM7N/Ey3J14+kKQMfKIab
TLSH
T17FC6BE03B3E64125F5F31A745A7D4569492ABD311B38C0DFA2C92A4E4FF2EE29931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/3208-7-0x0000000000400000-0x0000000000FB4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3208-76-0x0000000000400000-0x0000000000FB4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3208-468-0x0000000000400000-0x0000000000FB4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 11 IoCs

pid	Process
2536	elevation_service.exe
2552	elevation_service.exe
5884	maintenanceservice.exe
980	OSE.EXE
2520	PerceptionSimulationService.exe
2112	perfhost.exe
424	ReFsDedupSvc.exe
1692	SensorDataService.exe
3364	ssh-agent.exe
2464	AgentService.exe
3668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2812	verclsid.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b0f0ff5de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1828_1052525895\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1828_1837954666\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1828_1837954666\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1828_2137716074\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1828_1052525895\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311678430152649"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003342448ac22bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5d9ff8ac22bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c435197c22bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000290aa696c22bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f146b8ac22bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005ff8c78bc22bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{499FB2B8-DF24-4CEA-BFF1-3E0B569EB7B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
2536	elevation_service.exe
980	OSE.EXE
980	OSE.EXE
980	OSE.EXE
980	OSE.EXE
980	OSE.EXE
980	OSE.EXE
980	OSE.EXE
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
Token: SeAssignPrimaryTokenPrivilege	2464	AgentService.exe
Token: 33	3668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3668	SearchIndexer.exe
Token: SeBackupPrivilege	424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	424	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeDebugPrivilege	2536	elevation_service.exe
Token: SeDebugPrivilege	980	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1828	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3452	3668	SearchIndexer.exe	100
PID 3668 wrote to memory of 1648	3668	SearchIndexer.exe	101
PID 3208 wrote to memory of 1828	3208	2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe	102
PID 1828 wrote to memory of 4900	1828	msedge.exe	103
PID 1828 wrote to memory of 3548	1828	msedge.exe	104
PID 1828 wrote to memory of 4968	1828	msedge.exe	105
PID 1828 wrote to memory of 6140	1828	msedge.exe	106
PID 1828 wrote to memory of 4968	1828	msedge.exe	105
PID 1828 wrote to memory of 4968	1828	msedge.exe	105
PID 1828 wrote to memory of 6140	1828	msedge.exe	106
PID 1828 wrote to memory of 2488	1828	msedge.exe	107
PID 1828 wrote to memory of 760	1828	msedge.exe	108
PID 1828 wrote to memory of 2488	1828	msedge.exe	107
PID 1828 wrote to memory of 2488	1828	msedge.exe	107
PID 1828 wrote to memory of 760	1828	msedge.exe	108
PID 1828 wrote to memory of 760	1828	msedge.exe	108
PID 1828 wrote to memory of 2768	1828	msedge.exe	110
PID 1828 wrote to memory of 2768	1828	msedge.exe	110
PID 1828 wrote to memory of 2768	1828	msedge.exe	110
PID 1828 wrote to memory of 2596	1828	msedge.exe	109
PID 1828 wrote to memory of 2596	1828	msedge.exe	109
PID 1828 wrote to memory of 2596	1828	msedge.exe	109
PID 1828 wrote to memory of 4656	1828	msedge.exe	112
PID 1828 wrote to memory of 4656	1828	msedge.exe	112
PID 1828 wrote to memory of 5160	1828	msedge.exe	113
PID 1828 wrote to memory of 5160	1828	msedge.exe	113
PID 1828 wrote to memory of 5160	1828	msedge.exe	113
PID 1828 wrote to memory of 1692	1828	msedge.exe	115
PID 1828 wrote to memory of 3168	1828	msedge.exe	116
PID 1828 wrote to memory of 6060	1828	msedge.exe	117
PID 1828 wrote to memory of 3168	1828	msedge.exe	116
PID 1828 wrote to memory of 6060	1828	msedge.exe	117
PID 1828 wrote to memory of 4728	1828	msedge.exe	120
PID 1828 wrote to memory of 4728	1828	msedge.exe	120
PID 3668 wrote to memory of 3276	3668	SearchIndexer.exe	121
PID 3668 wrote to memory of 5176	3668	SearchIndexer.exe	122
PID 1828 wrote to memory of 2868	1828	msedge.exe	123
PID 1828 wrote to memory of 2868	1828	msedge.exe	123
PID 1828 wrote to memory of 1312	1828	msedge.exe	126
PID 1828 wrote to memory of 1312	1828	msedge.exe	126
PID 1828 wrote to memory of 1312	1828	msedge.exe	126
PID 1828 wrote to memory of 3376	1828	msedge.exe	127
PID 1828 wrote to memory of 3376	1828	msedge.exe	127
PID 1828 wrote to memory of 5168	1828	msedge.exe	128
PID 1828 wrote to memory of 6024	1828	msedge.exe	129
PID 1828 wrote to memory of 4252	1828	msedge.exe	130
PID 1828 wrote to memory of 2288	1828	msedge.exe	133
PID 1828 wrote to memory of 2288	1828	msedge.exe	133
PID 1828 wrote to memory of 2880	1828	msedge.exe	138
PID 1828 wrote to memory of 2880	1828	msedge.exe	138
PID 1828 wrote to memory of 5028	1828	msedge.exe	139
PID 1828 wrote to memory of 5028	1828	msedge.exe	139
PID 1828 wrote to memory of 5128	1828	msedge.exe	140
PID 1828 wrote to memory of 2204	1828	msedge.exe	141
PID 1828 wrote to memory of 2204	1828	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5793ff293df700b4db4de05dfbf9530c_amadey_coinminer_darkgate_elex_glassworm_hijackloader_ng.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hitmanpro.com/downloads
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7fffd07dc188,0x7fffd07dc194,0x7fffd07dc1a0
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,17664406165482309192,2997012343334701953,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,17437848462231955137,791184040555456425,262144 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,44011142630707922,13975727865245770719,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,6835087447987345960,3783557849239970729,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,4310678278058585655,6280357017036671845,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,1664534817293182526,9725233081423376527,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,56359413698907975,7871482088761281598,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10980452404091283573,11954338630174864363,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5500,i,8470743675542967448,10151040716705713483,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17847042105529346638,6324082901328619388,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17847042105529346638,6324082901328619388,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,7582320872147483430,16778614317764556976,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,1361208586826803822,10069105189766872818,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,11450537538359396719,199816146636100488,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,11483495044004838627,15107318478373024081,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5000,i,3656973010559724964,8921722005597176549,2097152 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,17128216896198251507,14018489241849069712,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:12
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,11454968137705861404,7004179344875806509,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,17520991117076313026,10638740021333702273,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,13950365575981560999,14936407794356137130,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,5129896462762935506,16175587588004584581,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17656499419231602105,326709343546224983,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,15697935511344541385,3433357589280726211,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6972,i,10030017298568208373,11039127051341670522,262144 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13818093070882419853,8491365373523996194,524288 --field-trial-handle=2584,i,8736826164209979789,910947246643621397,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:2204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2556

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09b2ae1d42a097109a94855d344316da7c9f125228c347aacee8ab0d6ab7e7be
MD5 a89e493919cba19353a0889db645c030
SHA1 69d0317e3db4f248f85dad354c6fcb67aa07836f
SHA512 1570888d723c0992733f65d5098c9999b2ea24f06f601026116ddd76f54624b4c25aab81b90d8f3f6e41404328e320b66e0a769631b7d33701c428c3ea51c40f
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbB+kn3Hnx:Q3q6sjBS+k
TLSH
T147D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e9f16abfded7c4c28b2bbd3775dee274d476738bd0de166bfd4d8ca9cd3d33f3
MD5 0094247049b9388fd7eb3753b61242fa
SHA1 008eb65541057896e8ee821b2d8916bdc591b712
SHA512 cab4849da93b625fa00f766ca1fa75c47ad6f22b59fa720b108f0cd5c0b123fdf3c99c9aa85b23b37f6ad1ff7416f8dfe914d729ad562babb9410012022aa1b0
SSDEEP 12288:p1XLsswWkxy2lRq2czAiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:nXYfDtczApNyBo4kx929bL3Hnx
TLSH
T16765012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 03536fb9710dd3c5a70b04b5f03431665bb0545a51b9e18b2357a9c4bc365f48
MD5 a306eba3bf759079baacef05220ff07f
SHA1 f725a8a2e50c5a05cf69076d157b5fb8fe7d27d6
SHA512 c448d81a37e9e70a778f0e4db8dc659fe108bbc5630a2854f30dc382a45e9f9d3b8190097cc80febac9f53ad33ad92631c442ae1a8643e3758627785797e422d
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVuArHsTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:Q0Le5ji0hmxfrMANyBo4kx929bL3Hnx
TLSH
T1D5859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5651eecd5b78fac3d94084b626a829176ee6fcf09637f9e449d28350ea3eb53c
MD5 891e15e6a830aeb9580c0bbf65e16dbb
SHA1 cbac5746ad1b7b5eef6173c42e1942462cc3a09c
SHA512 ee1d688ec2c12da3e2d95544428af127f637c1c6880b7c2f6eeb8fe67dd657ace135154c20a13825ee60e743c59d4d48bdc717630d196c1b19ee5c7c345293bb
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWn6q8wyuGNyBo4kx929bL3Hnx:b/ezSC6vUzPveHjygB+kn3Hnx
TLSH
T11F755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6975bec9bb9a9e83501bb2555bc66960ef368245bcb3ad77402f968ced0ad5be
MD5 ffd19220fce85871a59a49b437c05a96
SHA1 ad9f7998c8f934cc30d361faa87363ee82f6efe7
SHA512 b3717a195e98b95df077ed1060018ba7fc9a4c0c4fbf853b22a56abcd689199e38f2752fcf01d9022fe57787d6df458d6fa6406e676235ce424879c2e130e4e2
SSDEEP 12288:gVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98eLDAptNyvUgXZ32dT4ePc7N29CD:gVbqPb88hv/l+YtNyBo4kx929bL3Hnx
TLSH
T156559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 057ee67e01c199c217dfbb9cfd6f0cf41478389c8451dba1096edc0828378e34
MD5 11b03f163aa46c2d0bbe9d92d9ebdd2c
SHA1 bcd8bbb298a17288139b37203ec8226275042b96
SHA512 b2ec46b16471df730f8922da61de50da5ed64a3edbd4e3b440885b9073c15687eab72d72efb469f237e98772da0cd0683b2ab99d1c7ce150e70a87105146edf5
SSDEEP 12288:VmvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VmUNyBo4kx929bL3Hnx
TLSH
T1184523124B0C627AFBBD3E70755E8454CC35BC8D0D95DB98DE62ACBB58BCDA2CA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 98878f14d902466661ce9517597b743378442d4b6674ff8e3da9e7cbd8b32e83
MD5 6b906814065b8c5074b6cee4ce82f619
SHA1 d40ae291e87cac46b1d629c1ab580a48fbf8ac86
SHA512 b1ab85109af0e0791866fb33c5a70ffe76ba567bf976ddf6df0947474e12e016c765707525cdf4e2d38e805c6586d1cf9ef9cca3e06b3b30fb71651088abaed7
SSDEEP 12288:geBNUbTVO86UWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gJIU1NyBo4kx929bL3Hnx
TLSH
T13965CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4aee3a7e83825c987eac8c49df474eae8cff169fb236566330da728e60c514bf
MD5 90b56794e17c382df19eb41f40f02b6e
SHA1 fb56ece66450a5f0d608f2a60272665ce902d639
SHA512 0f5c8387e088c1e078f3b028b82361ad02d65a311a5b1aec0e7fbb489bceab5e189a6c0f2c8566f15121b85e52e3ca919a2b6166e71482f723a9b150eb0b0aaa
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:9QvGAdlCEL8c/DRNw5C7+k
TLSH
T163266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8bf7c0ab5b97e4b5f2bf9e08b714ec35c7183e828310dbe6e5d117d737b33760
MD5 f81672748a3844741d640abf72f30141
SHA1 4fa23f6c02fdaa64683ba018a7e61656e2f55893
SHA512 a801c2ad23376a79f907219a641e8d7fbed2fd554011698cc908b10d3ff0a368dc8d76329958d46efb3ed4cbe43af52231b47e73edbe37eabd70c4e4a841547b
SSDEEP 12288:MAwSfxL/2Dc3XDLLmt0LDQewsAjMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:xOewsAjTNyBo4kx929bL3Hnx
TLSH
T1A675E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 60fbbeef156f4b4e9d94865d2ea40380494f55d8dbb230baab1a098a4ef11434
MD5 d790b1c99a8cd135629717ae58fafbf9
SHA1 0a2b77844b92eedac921226b683b92f6650e91f6
SHA512 75ac7e01a3cd7b2f8872659533f66f613016a01cded65c0d73d9a7630476b42e3debf97c1bd8e1828c82f206a01af85feba1d98d53665b47950ae69ba8ec2a76
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHY+k:mUEtQevvqc2W1cpV2tI32Y
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2fa208834eef27aa9abefbc1131bde51eaf47de4a84688c68423dbeb19f7f34d
MD5 bebf98e233a344adef9e7813ddf45ca5
SHA1 78fb84e8d1a2b78b213435fe74459594a06c7e1e
SHA512 f7f55c1e873271fa880db20d8d9afd3ff937d853fe1fc53f716037f00e377ae0acde9115b235ece9c6363af371d771edc438afcea2c87b3f8c8638f632fc49ce
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zcB+kn3Hnx:LoquVjnm3+k
TLSH
T113D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 619aa6970014d2b5afb720b46270deb66ab91e7a6c0a9330a91cfe1608ed57e4
MD5 8b72ea71a3d8505c9cad401adab64a3d
SHA1 dbfb4574a06d137ae871b2dc185c72239cf50588
SHA512 3303db6beedd34080f1da54e924ece906d4a396784b319608ab35bb296f8ed8537d211c6c2ec0f827fe3e764e68e4f1ee6e8bf9a67af328c80b6fc283e255b29
SSDEEP 24576:1AhGL3IFoiwtA5l7S53yNyBo4kx929bL3Hnx:1AMUFoiq5BB+kn3Hnx
TLSH
T1C2359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 981a502d63e6067e86f2358d021e0b3665e9175d75c74e3fefb1e42d96710888
MD5 17bcfed52db2fdd71fc9d36337c56d0d
SHA1 a278d5415f2a5a96cfda6948276f711519f4a9e1
SHA512 596ea604ae54509a19a829900924d126879cf297d73151db570329c6323a98f43b6b654cc1c132726c690818ec079e8f1adc5d80dc7dc5e07255c47d771daad6
SSDEEP 12288:Xmw5HEjsChNzBFgl0WDm+C5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:2wu6OWPNyBo4kx929bL3Hnx
TLSH
T1CE65F10677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f2094ca104e8a4b02b4998191385b967c4ddabf90b59a2435505c85d224c9a38
MD5 86b9019b4349f07c0073d7e02cee9d1b
SHA1 451e44a1f9500430794b846d9b9b34d0d70dce7b
SHA512 57d9c8cc9569f76157b55a1d5fe15bd35de7a135bb898584d1a41940a24764aa7d97324569fd3263e457aff7a3a7d73417ce38603f78d4d9335464823ea6bd5e
SSDEEP 12288:igZ1IycLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JZuINyBo4kx929bL3Hnx
TLSH
T1D2551216239831FAF2AB2678D8E58544CB32BC461B7283CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9c2c71150faa708cf08515d69f59b3f4c6751012ff7876e04ae377290b356279
MD5 1f9e0a0fc9ca63ebac13335c7109c1aa
SHA1 9edcbdbed06724f822e7f173cb636d0f943c48ad
SHA512 5b6474e8cc0ebf1c73bd5f48faa35154eca86a8eb7d5fa3722100b29f3c156485b6ce3a9fdef5bd2cbd7369a57374a4d227e1b34b6bb05a81173e3d09960f73e
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:HQRQyi36YOcPbLvw2gAf+PN3W+k
TLSH
T1E6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 69b100937b62509465c2f8f8ae5d8e5d23570c45ac9ea3ecb15ea027c92634d8
MD5 154e15333265f8049087f74b1d6db3c7
SHA1 7f9637dd32699702c6874f39966acbdfffb0e4e4
SHA512 988fdf8f23c7b19425275b049b9215e814498e918e264b4a9a70a52bf6089737cd4734ecd08f7f761db23e36943467d2461cb4c8b54b31777a09646f0c0b2207
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:xQRQyi36YOcPbLvw2gAf+PN3W+k
TLSH
T1BC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e932f0aad4d504c6546012bc1dca0705a3d2a45e291bbc0c8f463dd561b1ac0e
MD5 d2b2ef6d269247fb7c36d94bb54f7ccf
SHA1 1454f5ca000b3fcc1ebbcc934aee99e7f90b186c
SHA512 59269e6afc2e3fde771064855ab7603834650b56a85374509f6cbfeadba636f28f55a46e708863a67d990126aeb332be7d578ca4ff6250fb9a6f33d68427f91d
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0YNyBo4kx929bL3R:Q68Qg55nhceWu7PNU3/sB+kn3Hnx
TLSH
T144B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 36d0cc32f5da52dd71990cf82cadb32d851e7203e28f1e4403a65a419d359774
MD5 acb6834421fe4c9d382340a3902876cc
SHA1 3a127909bd808ae63af3803be79f516e440dfe73
SHA512 79772944617d21d2bee948ad003fa3d16989463218a4f35991c1068cef7e975973e11057d678dc8ebfd9123f1d5872632105e5782632b38cc2ec6bf657d76a35
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99m:8y5112gYy5azzVvt69nLKnhZ5+k
TLSH
T132167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6b22fa24dba031d8fdfd9d9b0ba51f4a80c7fd789d1ee86443eb819528c7b75f
MD5 6634136160e7ccf04f01041288f9a1f7
SHA1 07c9cadd0892eec23147be1be3ab9e2357e96091
SHA512 b060bfffe19a21241c0569a5dc7d9a9e2f88e2d385400f05504c1b37f3c87af34df635c1769fe32ace8a048d8d07f64ffec4340a0b4a99221772095f7360a890
SSDEEP 49152:uB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+B+kn3Hnx:8u6Jmdxd2de+k
TLSH
T121D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9daf64734161f18a8ec9b15fe71de532fe69b7441e321fa5051240cd0d03839c
MD5 e88c23621d7f02adcf7410664be1d9f4
SHA1 b14f031f308a0da4d46b5023b62aef6a77251a49
SHA512 7e6962a7b43a669566163531320455633d88b56efd29c6d8a6fadf95a5fadbc64d4cd42bd401265303a057204185f1f7c53fd367f16c218fef86213fdfc55294
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xCB+kn3Hnx:9mifPWR3+k
TLSH
T149B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b266b570ab690278b43b19466872f84858e39bebbead8c78a3af2d62f453430c
MD5 e7e3aa51283b36e64a9426e597d3e344
SHA1 24f4328a3744348cfbc5350aaa3799f52e67857e
SHA512 bc994e3fe73c193edba4fc1f2c5ba60e8672286a02dd615153acf1acb8b7f0af9f6104fec457ba36ff604dd97fe786b1855e6ad361a538248ab32dcc44bf8652
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHqrB+kn3Hnx:z5dKii61d+k
TLSH
T141C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0be974ed9fca5ac91935e72b2a42e5f4fa7500f2a024152f053797cd249df9a6
MD5 08dd3ec24003c7f41cc5c924193da2bd
SHA1 e87af5d3c3c3646cf8483284a81ea1d763ec5bb0
SHA512 2d6a0ea26c9ba9c764696e396b7aa87d66751c000e66730f29e8cebe501852842c18a1baead681abbb27d843a67e7afd94c8c8bd618449d0cf767989d8445f12
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wOB+kn3Hnx:CX2imphT+k
TLSH
T16295BE13F2D901E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d48f3d5b745f4014c72426e395a4f169fb98d4fcbaf61d758e902a7175127961
MD5 e252067da59b900df4788c5cc9c62192
SHA1 9a1703e29e9927e8337733391a7f6557698c4bc0
SHA512 82bcc09f7c22c0b632f1c29c7773a8eed89652adbc290ca2bc73571c4491fbba4a2e235aeec42ef8e0c2f6102650531f3d58e3249bfa534b2d2942c56a4b0288
SSDEEP 12288:5nLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5cNyBo4kx929bL3Hnx
TLSH
T1084523129A0C627AF76D3FB0644A8158CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5df66bb1598eabd47659459008d54c034a328c1516e9bff1946d6289d411bef9
MD5 339781653a4204da0672ee6eafdf9ad4
SHA1 6eba78b032a6381870ff379997eba21595f50ecf
SHA512 191df2423dc25d7f3e241b9ad99c7f0b80c9b52bfc3dd734b06f52928514ec2a14ce1e26704fbb5f1cdbdf9c70de1ce44e75f4bbf23cbe56f7468447d1db05ed
SSDEEP 12288:G4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GnNyBo4kx929bL3Hnx
TLSH
T1D34523125A0C237AF76D3EB0654A8098CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a477b69270257181c9fb34bce658653096ea3c37aace8c3092410ddbfdf658d4
MD5 74c6f606dd607b12e59ca78867d44861
SHA1 f7e0a8d74c16b63b7b9fa666300b6a39c0c3888a
SHA512 1a06afa3fa43e45398dbe7747a05fa4e1dde96958a8315ffd93b89ec9a40a6a3213e78902865d52e0bd0fd74c93847280f568479b5945675cdd7afa76d5b9c34
SSDEEP 12288:2OLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:29NyBo4kx929bL3Hnx
TLSH
T1CA4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0b1c8f5ea03b0db652da4e4c91cc5517d6487cc63f81e92ae2ec10dae567e7c9
MD5 e2741ef8452502385711fc4953ec1fe6
SHA1 8312d92361a2ff5c4a2013970165a2a0a0bfb526
SHA512 2e0db367461032c4222232794b64d23b718aa50d940e3e9200cee14f60e3ec6a2746fde60d81a2378257067d95268f7b8bc41d399f89583d47292ea8d281100a
SSDEEP 12288:DVNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gNyBo4kx929bL3Hnx
TLSH
T1AC4523025B5C12BAF97E7BB098568054C835BC8A5B7297DFDF124C7B0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e24896080fb355ec1a93314449177bb6e6f83e4b22ed7eeb7578d3f07a735cda
MD5 0f0ca4ad7c1b7100bbe803cb6a01d50e
SHA1 a4feb72d378c6526fef5d696a8d897e9ff54a9a5
SHA512 ccc96bec70fe67dee1513015d43326c3bd1a0f2d219e00b88b87c48f81a42e3c54ac41e5689436f6e0641a6ea4d928baca61775a6f46b478d89b38a2086f5580
SSDEEP 12288:e1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eqNyBo4kx929bL3Hnx
TLSH
T19F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ead28408c9999db77371b91211245260e17507122f44567a61eebc1fe53d5340
MD5 751141310c394cdd943a8c102c50dd68
SHA1 07bb33da5355838c0e95c87ae6410d4e6c8f4cb9
SHA512 0547709f1187c93883addba1bd6fae39f9fbb3ac832d8bd06636f15944e5246bac5312e20758b965dc682d9d25343167a2134e6e3b80a6af3f59066bd45bcf69
SSDEEP 12288:yELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ybNyBo4kx929bL3Hnx
TLSH
T1B64523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1de941580b6a9d6129031a578e0e0a1702b7eaaecae138a122163eac28347da1
MD5 56c1802b2cf643533b2ab5bae518d06a
SHA1 456faf04e443053f1f90ce9f08cf7877f7a3d494
SHA512 a948831894fe9990b16c1999f6b68dabd1be217b70e804cfaf0bc3f2508defb8fecb7b8cc734fae76fbd4374bbe5d548866fb44fec7e8c0d5f42f28095566a3f
SSDEEP 12288:4gLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4fNyBo4kx929bL3Hnx
TLSH
T1544523129A0C227AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ff4a838ef5942288f7bacb6b29250b16ab886f68ce570aa355102498b2390f68
MD5 ac2c2a3071fbe2abca07faa5542bc6cf
SHA1 54eeac2c87e4349cc79b214dc53e7484b05a62f6
SHA512 167657368ec36e50bc18d75e5e158289d5890fbdc3166854a3f4e42f65f9f25b859ca4436140b307c43696cc9468d175fb82ec2b63c75e709d05f6fec70daeff
SSDEEP 12288:8iZwbjzzFEoS2cPvyYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:fZMXzFVSOHNyBo4kx929bL3Hnx
TLSH
T1BA650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0ffc57c504c2e0ebaf05b127457fce68cd9db8391679cdb8fb4854f442b731ed
MD5 c9abb8812c22d22ea4cd2477c5422cc3
SHA1 8cdc52ffe67fec82f49999b203a4f75379300413
SHA512 0809427d7fc1b8e92a60768917f0d5921a7366f90455e1ea51bf890286a77974ef7b19a02bc8d7fd0243661001fb6da14706a1193a059ec68ef8827758d79ac3
SSDEEP 12288:mbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:m4NyBo4kx929bL3Hnx
TLSH
T1F94523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a4e0eb545786fc568c094acb30e8c939798df2d05a0e878ba3e402fba139fe4b
MD5 7cda46b196c022ce99fa8e8843a6b9a0
SHA1 2a313a4ffe7e7d4c7352052c6687cb4ea00a0d5d
SHA512 e02466a6302313f62d0e5da950a5490fe77a2c86bbbfaf3faff18410eb003f33c2b51d9503942527d1d09dfbaf4c86cf5cd1d36abd207591d0ad1b13ef3a8d2e
SSDEEP 12288://LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/ENyBo4kx929bL3Hnx
TLSH
T17F4523125A0C227AF76D3EB0654A8598CC34BC8F1E9593D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1bfabfb6e08bdf6bb2c8dd02021b122a336d87b4b3c842b4214612274aa64613
MD5 5b6add5eabc6def23167f8ee6924f758
SHA1 995b9836356bd8b0d2c4615e95ddb161ecc84ee4
SHA512 fc0d98a89429c83f0ef3d0a93324d916759d0f14d6a6b8c3582c1b0949afe0329008b6491fbe142992ff910077f7416f237695b56ab463117f3369d6da225592
SSDEEP 12288:oyPz5L8cLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pzyDNyBo4kx929bL3Hnx
TLSH
T1EF55120777A831F9E17A6234C8960A01E771BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9a4c6282f6a434e613f966f036c44e3ecf92c6d43a62cd75e2405721a11d31b8
MD5 3d53328082f248c25deb543a62833839
SHA1 9f9c7492c73db8f489bf37056e4b5668847b168d
SHA512 2c97e4b90b572b40e350167ad2e6eb20f5d0343ed7b7029d114f76c902c92bcde7204bce19fc2b3fe29ae75263856a0dd1a7977eaf01c0bbaba2918f3eb0ef4d
SSDEEP 12288:YbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Y4NyBo4kx929bL3Hnx
TLSH
T14E4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ddd869642f8082bd1e8aab9d703c79e903f55e0085d88e28a6093206a7492f14
MD5 11af6cbaa8629cb9b333bf914096906d
SHA1 b55b3ae2e29da803fff6649c0a8f35067faa2a39
SHA512 4463c171504166668852147ae20fb2ef366f473a28d087b0fc97f64d378423fb2bd3a05fe46e9af46bb0e7d711adf742a13d7ace22b8a08eedacb8c472d26eeb
SSDEEP 12288:1bLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:14NyBo4kx929bL3Hnx
TLSH
T1E14523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e1702be607d665d5f89f666c292fe7ad573eed87c0d9e228d4fd8de81268a6d6
MD5 8019d7975e4481f3873e3cf4d5eca1df
SHA1 393e6fa2214265ba3094bb29324ad18b8139d933
SHA512 d5c271988fbdc76b35edb7aa35ce08fab140a17b3d60d0dece7bfee19513d15fd84a495b08ef160030db73b869f8bd7a692979bf8140f3c8d1dcc590479f39f6
SSDEEP 12288:QyPz5L8cLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hzyDNyBo4kx929bL3Hnx
TLSH
T15855120777A831F9E17A6234C8960A01E771BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 36bbd2a9cb3ad0234c208cde3d9a3559de0872fe19367be8b5ebdd45368098e2
MD5 7f8cc6cb38d5329528b84f38f259ec0f
SHA1 c10f4b3dd02083c6a80888ca02d76b16c28ecab8
SHA512 021408c546429f411ebd4a15ee34794e122e94b8ee82a8c448f064fadd276f4486ef3a8e2f317a1a441ddef438d3387c6fb26c2983b09e121d817be66fd0ed91
SSDEEP 12288:9Cd98WYoaLHF3z0z04PDvh+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:oTtaLl3z0zDNNyBo4kx929bL3Hnx
TLSH
T1836501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e8a195534682153b9f3032444ca372b95704d71a2ad4199a6463baa10bf11395
MD5 26f0158feb1570cb6ba2d50b5e2cf5bd
SHA1 ba69af9e0eb11360dfe08e3a104c3b49baf688ef
SHA512 4229107710aa59a7a573e32b6710abbf9336a38376044aca0670387d9f622696fb86dbcea2812001cb630b8a735b70c407d0af6d304cef187883de41f9fd921a
SSDEEP 24576:Tfwvqk9RX6wkyAI0NyBo4kx929bL3Hnx:XMnYIPB+kn3Hnx
TLSH
T1DA85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ef1db8db5b29a1f252e44ca2a086d3126ecae8f68b7ceebef1d6658bd464487f
MD5 f76c6633dd035c80efb072df08316391
SHA1 71fe370309d2e6f18692a544a5e0bfdb6c25e2a3
SHA512 622a6ab3346f02891d4e3d64a3e83b24d139f0baa86ca7f9f39ccb459f7b756d17264f921e9fa4e75fe0f7bbb3db449591eef8d7d52a8ffd9f15118eca86bbf0
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uB+kn3Hnx:XySzP2+k
TLSH
T1C4066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c9ce4fc73c250d24467877aced25ab7deebc98801cee067270066d2475df0a80
MD5 f9a57d18aff712fbed13fe7f9147aeb3
SHA1 aa45f088ecdf70266be6a231791720b1eb9b9ef7
SHA512 9402f8617eda994bef09e6b9fd17992c901021ca35fbb200c204c1c51dbe73c8f6b7d1bc8acd46d865894affeb8fe88e4af8f252c30e5e5717887745104934dc
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY3NyBo4kx929bL3Hnx:W47JUQjTirIhCnDHUPfF/+B+kn3Hnx
TLSH
T15F65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 36a3101f09a2cc12523b4da744180003c761b926f87f077722a6bdfb8dfab638
MD5 b9c0d737411b34b2332c8bf25117488e
SHA1 187a36487fa3dd9031fc61c850756f8e60beff84
SHA512 2a628a9b535e60295b2926ad8579ac7c5abe5b4a36cf8498b8dd2d975fd2e8a94c392d8c2121674dfc8063055e62321b42ab84d2005d276b86d236a40b1d6980
SSDEEP 12288:npsfLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IINyBo4kx929bL3Hnx
TLSH
T17F55F00AD25812E8D16E2274C7468A40F7337C5987E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 594f269c87b8c9af1abe83a19d88baa3412760a171176155596ca7e2199fb8da
MD5 932a992d150466efaec3efb870c2157f
SHA1 396e11fda52a0f82257d763ddf06637ffa78e25f
SHA512 9f293794cd2f01e03377c93f7d7ed12a7989e2d4aa5ce944c571af2991d73c4eb1cc3a2bd86a9ca18ecfa7b5e08562049bfca4472680b70e433e8b869af857e2
SSDEEP 12288:tYCdKU3fBI5O7VAlBuM3om3YOQBWT1Ssm0bAOP6ey:tYCQUPZVAp3YpBWT1Bm0bAOP4
TLSH
T1BB451640762AC78FC6A940325E36D6CCAB707D01FE456E0773C9873F9476668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 329KB
SHA256 3a3e23d315bac2421c530e5e237804247f7eb6f1d303aaf91e49800b28c2d66c
MD5 fd7b170b1dd4fb540e7899088ad4a999
SHA1 1d02243b02be89e42d94d2a48e8b44a5ca6d67bc
SHA512 adf5a020e661b9abdeccb24cc0470b407ccc923a20d7a8121f370f02a413e34e9dee591724c6b8f14b164885a08482cbfcd207aa48a6db72d2cd4d68535dfe05
SSDEEP 768:idlTP/lToOlTPBlTz2+EQMbqXrq/ThjdlTP/lToOlTPBlTz2+EQMEqSdlTP/lToj:Lbg3L7JN9Cx32LE41
TLSH
T1A6747321B764B229C4B380B79870D6A79A3DF122CF2242463FD51E95CCF2287677AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d396dde5a285a2fa4180dab6162471ea4f0e73279c195d5814a355e7cc2df730
MD5 acf53518149f0f8cca6c853d12edf1a5
SHA1 36a7028bf75830d9fce52429de80a7a0778c8958
SHA512 efd95e0e6a3ebfd04ecb04ad5e70bb23d5de2507ae678407bf60d2b5251826da3c30bc8b9dc2bb5aa3e7f60e51cef5f431131d82b915cad735e9c43e2c2324d4
TLSH
T1727154421FAE1BD1EB2187F19DDA49A636F1C84521CF4F31464BAC336712FAA5BE1123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7abf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7abf.TMP
Size 2KB
SHA256 2e6f3f0919116b8aecc7127b4e03e4387ef261d7d1fedb87adc06b606a56a88d
MD5 25351ec0e90820fb0b6591446cedad05
SHA1 a6cd3ad80cf05dd853e06b8c53dc7aa45c12d06d
SHA512 a755f21f688ab61cf4a1fd9a34c10fa0e60663e429a2267e9b38b6585b963bb802b9ca8cf25c47bf5d2e9fac4e143da692ab3163dfef5b768bb2f7fcd397fa96
TLSH
T190513E512BAB5BD2C72687F1DDEA046A36F0C84861CF6E30404E6C336B02F2E5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ff3dabf5ea6dd7bdfaca148c260da88418dca11eed874e251d8675b91a2bcbae
MD5 8c3ceab0a641e4f9ae5b62b8f514cf35
SHA1 671b94e31639739af097e4f3df5ba76f1f4bf3a9
SHA512 2a49b8501f23fcea62dabffcf7baba35e824196b247faa8438314c3fbf1caa5ae15530f97e86085a44b3f1d5a1eada05780b29fecf550e42f8283d5c996c2291
SSDEEP 192:DKJDTHRVaaet1vEGFkXB9QfLMkig2IwXTXjc3a3zT:DKJDTxVaaet1vEGFkXB9Qf/ig2IwjXj7
TLSH
T1C4D1AAF383E4D62D9A1196F0AA14AE2FCE5C0514571C3D6A89D4BF17D3F2472E10266F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00e57dd5033fbbdd5a5e9585046a399d1aa4a1d1953c6678badae03676aac0d3
MD5 aa1373e7c559b28b78ff6c8c66e1536f
SHA1 0a8912b789dd74923d5ea64e585a59a05cdcced7
SHA512 e8943891680192f2c2d3ae18fb43e2791d08fadafc76048d57e2c78a8d087c992ca3e2f93a9ca12e231f8422aa746799b1c919ce07e0d59fefd6bf9d649cd139
SSDEEP 192:sxRXRZCh/fZsXewGLzoA8pr2/g6+WNGS6/RVt1dVoBRCYTGmIgVBJ:sxRXyh/fZsXepq6/5e/pA5
TLSH
T1E742B7166928A93B5CC7E21DBB65BF53D3F9107261D41E48EBFC861C04E7ADDA20740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8a91798c534de3eba207f529c5ac3008cce64e6c3193238269a622e9e08e478e
MD5 996aeedc0341ffd01b9ac13e8d7c7848
SHA1 72d7d080f704c20034ee891044dd8dedd55facb8
SHA512 e2395cfcc137e51043a69ea2504b25f09cae562e73e710646f88b0148b29a5265ab85e3fe30566601f21932655caa3544d2448984b63d23f4881dd8cc14fc277
SSDEEP 192:sxRIRZCh/fZswbegZ1uzoA8pr2/g6+WNGS6/RVt1dVoBRCYTGmIgDJJJ:sxRIyh/fZsMe+96/5e/pAF
TLSH
T1E342B716A928A93B5CC7E21DBA55BF53D3F91062A1D41E44FFFC861C04E7AED920740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 30955e86a2935b061bce371581eb3cad98512eb4a4a9c090abc61fa417f87132
MD5 5ee6c0c84e7fa1ca33daf5bbf377b296
SHA1 803515b9748d9b2cb034407f6692b488eba2ef6c
SHA512 ccb1c67b09ef49063eaaf44589340b4ded9ed76670a2fcb45864888b673e22561b8a14e4cb028105177576c6c11a2e8ed0fb188332423884f2c16df0362ca02d
SSDEEP 768:j26HKo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVNVuwWro9te0Urr:j26HKUE7MRWgs2fw2u1jaq4wtEr
TLSH
T17DC2DA7B640CCEBF4F800ADDDC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa298778-3edc-495b-a9f2-3c5d3bbf241e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa298778-3edc-495b-a9f2-3c5d3bbf241e.tmp
Size 12KB
SHA256 02eae41721111f8ef6330c8ce5817b80dc44911785b74c44aea0811c80133641
MD5 867a3470537d93872db8b134aa949261
SHA1 b0759d5f357d323dedb141347e41a31cec7d54e4
SHA512 e2e11746ccc6664907185660b284f1ebb4d5ce5462c40a40b5b49bfc1dd7f78ac30775e31a52cf86b643a5082f2285ede877cce4ef2c35d6409507b1f72dee03
SSDEEP 192:sxRIRZCh/fZswb/gZ1uzoA8pr2/g6+WNGS6/RVt1dVoQVCYTGmIgDjJJ:sxRIyh/fZsM/+96/5e/2Ar
TLSH
T16042B716A928A93B5CC7E21DBA55BF53D3F91062A1D41E44FFFC8A1C04E7AED920740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aada6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aada6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fc372c3c4ecf25b0a251cc2b344e3b2535c3b6c5087265a7e13d18a99b6f8a02
MD5 580dd7abb1a793a58cd4b74ac59db595
SHA1 e3ea397b00675829b5e4623c0dbc07c175215462
SHA512 1c0b5728378d901319fc5dd0f136147143e0072b0b51d20866625d83ddb0814eb972810e906a7e32ee7462a8ddcb68b777f81e150fc8db9a6ae31ab4e24f6bd6
SSDEEP 768:hrv+4UNbdz3su/TBOWGa9ONXyer1IRCzniB1eVH1SK7:hbsbV3tNSIqnOEH1l
TLSH
T1B303BF36A0A89E338DE2A3C6B14776137FF86057D6840B90EDDE2F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9b19e1938c2c26f65e359a4d737793c5774f14512ce578da91e4cff7962372e4
MD5 b447f03246ed40daa3f6d4301006cad8
SHA1 11435b85ce13f1d110826535d969d94dd692cb42
SHA512 1fee2ca525cb835db488116f8bdbaccc1cded63a75adf9866cf713f4f6c7f9386fe1f0acc20e9ee772c924358bcf883c40e5cf84fda68e5ab6d0c6d1c9732a5e
SSDEEP 384:npZcIX38N8uTcTjbpJuhf3RTpXOVc3mXzFjcXdXDt0GrYGgAN8SyrCZr1IR0VhMh:hX3Te/TBOWGatDt0ONXyer1IRCzni9hX
TLSH
T12BE2AE71A8A59D334CE6F386B2066753AFF82063D5C44B54EEEA5F0E049362E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f1b6e4bd9062a5ce54d051c3ce66a6806981cb38201457dc17377ae3728be369
MD5 6ba79f2a328e82356e07974b31295cbf
SHA1 8953c87f0400b7f97756493e0b28ba58890b69d6
SHA512 4c53c4909be6bcdf51579ec6930304b1579535f9337617e58620e2a32d611e55da1464e1b39d787c34d7029f2964a59b5d5359d2bb4b444472910c8809eee434
SSDEEP 768:urv+4UNbdz3so/TBOWGatDt7ONXyer1IRCzniwheVH1SK7:ubsbV3XnSIqnlEH1l
TLSH
T18803BF32A0A9DE334DE2A396B14767537FF82067C9800B90EDEA1F8E059759E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea513d97645dcd9ca6f48c7ef5042d764fafe1e109db10aede0e013d556117a0
MD5 fa4e16db19b2d3c605c440c5fff2144e
SHA1 fb94f6c301635b0bfce97dbcc3b28606d80aa3c0
SHA512 84d901f3d611fa8067242b7e44409edd44b5aa5b5c5666d93f53f89dc7339f884c136951e56266260e01e92055e075eac0773d2d8bc23a736e51bd19e118144a
SSDEEP 768:Nrv+4UNbdk3Ee/TBOWGatDtLONXyer1IRCzni9hY:Nbsbm3p/SIqnSY
TLSH
T1EC03AE31A4689E334DE6A2C6B1076753BFF8205789C10B94EEEA1F8E059756E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a153e5de6792605418e9f509b54ddeae78bdcff8049a6809785bfae0247894d5
MD5 463dbf488232830849524bd3f5be4c0d
SHA1 66c3ad4bc9ddf983c109287fb5a42aea59920472
SHA512 aa380407cecadac8d727f7722a950d856056940319cc88a364445c17d68f23de0fa02bd580add831fb1950a74d2ef840cf1f27f9b65b72b40f6898d79c397a64
SSDEEP 768:6Fj33PwgDdxsOWGatDtTONXyer1IRCzni9hX:s33DWSIqnSX
TLSH
T176F27C76D894DE27ACE6A7C2B6067743EEF410A3C5C89AD4EED95E4D00935AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

dd4e250b-fd0b-49f3-8181-ea3e74691a20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd4e250b-fd0b-49f3-8181-ea3e74691a20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_46747147\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 299722c272d146f4b0432b31f4ea6fc4eafe6993c044041ce457a46b03520d86
MD5 ad77e815c6dc9f9cc2ce8bac049d376d
SHA1 9419f5a27b8f728537c3f7d9dc19a0f131e87996
SHA512 3d8d4802ee1284f9f9269e16c3b5c066c3b972da1e1906e055a2610beb11eb5a8b372d843273d0dcbcac723bdbb0588ebbc9078b4bf1285c8698d418b5717535
SSDEEP 12288:Jy7zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ogNyBo4kx929bL3Hnx
TLSH
T1AF452312975C623AFA7D3AB0645E8124CC39BC4D0F50D6DBEE1658BB59BCED24E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 31a24747125d617eb690624f1e5a8ae9d66b09bd32e95cb39debacd95c5afcbb
MD5 ae79aca29517ca7669f8713c6b8658d0
SHA1 155101288673b0ed4797cddcf4b509ec723b859c
SHA512 d59d6e8def8dc0ed727aeed7b2a00a71db123a290acf680ffb4e1cdbf1c1a2db852975aadfffb128f97dc27f85cda436facde88465ac897910e2584363da2eb6
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYGNyBo4kx929bL3Hnx:tgb4mBIBhGF4B+kn3Hnx
TLSH
T16365AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9c7e9fa27934fd0708d8fd2f6ba769c4b703f0433209734c8fca9cbe1b1b3500
MD5 2ae97d00efe470b3522b3c6a71dcfd2a
SHA1 13fd70ef3efddd83309d8cf74bb4c267180229b7
SHA512 0a2feeee539b0742262ceff7a81e631acb9c820cad863809ba788084234c43c2a99bd505ed4ae6e7cf13d2d17e6050fa5e63a3ec457e221aa6a51b437776eb32
SSDEEP 24576:WG88u8FpJqH1Jzria7/mHNyBo4kx929bL3Hnx:97ZFPqVAa7/1B+kn3Hnx
TLSH
T16B85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8b8a02e9d0008074f801ae18a456fb1e4f1cce5f2cb5041b41921648822b528f
MD5 adb2ac133e4452b403be4cbe3baa6a6f
SHA1 b05a019defdde88b40bf58c0ee7ca1653cb2c33a
SHA512 309ac72a71a87b3989368f69ae30936a4caba863451f00edb7fc0df7d271817a39762ad2f0405be222f371249753107418b40f20bc07dcc3302b9c2139b4716f
SSDEEP 12288:wHvUrBFrEjwaQULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wPUr+NQLNyBo4kx929bL3Hnx
TLSH
T17065F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 34c97942ee872768f84c449f5742853094aa619c7ff9b7c8528e91f8034739e5
MD5 30c49732e22db6b5580e86fd525d26aa
SHA1 1c32457937601f7c7abd3ffa6666b3c33f48fb38
SHA512 18ed3eb5b71a398811b807075a592713dbdfd13749564fd0a27eb8e4c3d517699b1e349580873d25a722f6c8441b0d29a125308eabe33e5d03d911be08bb1f46
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0B+kn3Hnx:rG05lO43bR+k
TLSH
T1C5D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2544a4026c5221fab9e773a865187f607a3f35c9b77dd53a77eb8ce547fd666b
MD5 bb6154f661b76ace13473b08923ae7ea
SHA1 31eac53d1429d0ae29babd9aee9f3d87b07ca07b
SHA512 eac8fd2da720af93e2a639938ea523a718d712fcd816b9716806fe714f5fcc0e80a0660992b0b6ddc745b39690588932993ca118a5ffc207a310a093a5edb4d4
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJNyBo4kx929bL3Hnx:ca5POZ3BJt2pasx2+msB+kn3Hnx
TLSH
T1FD65AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fa331522f7ddd224565a46dfda02abc7e97045a94ec311f1aa50d1d512650360
MD5 f53c283ed5f917a984e5a469030deb45
SHA1 61a6a88042ad02dc4a698de0b39ce4f74adf2a7f
SHA512 57461378e614d9aa039488108ccdbaffd727336d51bdfd1ae7b772d75b372408a4854941c6d04b67a844c808a7409f7866481a92a3cd19a9fa09d55d89186b74
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkvNyBo4kx929bL3Hnx:vNc/zEOVHFVB+kn3Hnx
TLSH
T171858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4fcf1be0488940d1964a40409e1554960fece92eec7b6f96a7ce5aa84b858ce7
MD5 9c139b23e817a1d61e850903dab04eae
SHA1 fcc73b1ac73f0982221c65bdb2f0e6622ea1b31b
SHA512 ab08d47f819598262831f5a5155f478fc88d1db9da923c6e2736f7222e2a5ae17340c34321e99bd6b8aab7c086107f470804795a6aae3f8cab1b1860fb03d232
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmlNyBo4kx929bL3Hnx:NTMwBtOmyB+kn3Hnx
TLSH
T13B55AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0dfd6e369a1722aa9c920bb494b9fe571282d6a3612ffaef59d5f06784ed0479
MD5 de0b11cad7ab74677edf6176c2d23fc8
SHA1 d79f2288d90d4a213e71c6add8291ebcad9cd8fc
SHA512 6aeefe818fb4ecb0c536681ce232eeb35752af383931561e4c1f1cca93c187ecfe75e0f478f0dbe9dc6b30e9d1dc062910a371676e52f837874dc63a2bb39df3
SSDEEP 12288:aQcMxWDXN1Dp/fshBItT1IQgAHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:ID3FHshBIYQgA8NyBo4kx929bL3Hnx
TLSH
T13F75E13EE65C00E4E57BD1BCDA538906E67138AD072266DB06D4C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/424-686-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/424-87-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/424-81-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/424-262-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/424-688-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/980-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/980-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/980-53-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/980-162-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1692-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1692-352-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1692-332-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2112-225-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2112-77-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2464-129-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2464-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-124-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2464-118-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2464-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2520-187-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2520-72-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2520-64-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2520-66-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2536-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2536-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2536-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2536-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2536-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2552-334-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2552-351-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2552-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3208-7-0x0000000000400000-0x0000000000FB4000-memory.dmp

Download

memory/3208-0-0x0000000001480000-0x00000000014E7000-memory.dmp

Download

memory/3208-5-0x0000000001480000-0x00000000014E7000-memory.dmp

Download

memory/3208-76-0x0000000000400000-0x0000000000FB4000-memory.dmp

Download

memory/3208-468-0x0000000000400000-0x0000000000FB4000-memory.dmp

Download

memory/3364-113-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3364-107-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3364-105-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3364-326-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3668-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3668-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3668-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3668-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5884-51-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5884-49-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5884-45-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5884-39-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5884-38-0x0000000140000000-0x0000000140174000-memory.dmp

Download